[bug] Fresh Codex setup requires a globally installed host CLI

Affected NanoClaw version or commit

0399a6dfa98fa8fb27b7b267749ed04d6880379b with provider payload ee0d0a34f79a6e6cc0dc4d5039081959fec09ca2.

The provider payload is unchanged on current providers. The picker itself was separately restored on main by #3790.

Host platform

Linux

What happened?

A fresh Codex setup reaches provider authentication, but authentication stops with:

agent_provider: codex
codex_auth_method: browser
auth: failed
error: codex_cli_missing

The provider installation succeeded. container/cli-tools.json records @openai/[email protected], and the rebuilt agent image contains codex-cli 0.146.0. The failure is on the host, where setup requires a globally discoverable codex command.

Setup then recommends npm install --global @openai/codex. For an unprivileged install user whose npm prefix is /usr, that command fails with:

EACCES: permission denied, mkdir '/usr/lib/node_modules/@openai'

This was first recorded while investigating #3787: https://github.com/nanocoai/nanoclaw/issues/3787#issuecomment-5647730398

What did you expect?

Fresh Codex setup should use the exact CLI version already declared by the installed provider payload when codex is absent from the host PATH. It should not require an unprivileged user to write into the system-wide npm prefix.

A bounded fallback can read the @openai/codex version from container/cli-tools.json and invoke npx --yes @openai/codex@<exact-version>. The login must keep the existing isolated CODEX_HOME behavior.

How can we reproduce it?

1. Start from a fresh Linux host with Node/npm available, no global codex command, and npm prefix /usr.
2. Run NANOCLAW_AGENT_PROVIDER=codex bash nanoclaw.sh.
3. Choose browser or device authentication.
4. Observe error: codex_cli_missing.
5. Run the suggested npm install --global @openai/codex as the unprivileged install user and observe EACCES.
6. From the same checkout and user environment, run npx --yes @openai/[email protected] --version and observe codex-cli 0.146.0.

OS version and CPU architecture

Debian 13, x86_64, unprivileged user

Install or update path

Standard setup with nanoclaw.sh

Channel or interface

CLI / terminal

Agent provider

Codex

Relevant redacted logs

agent_provider: codex
codex_auth_method: browser
auth: failed
error: codex_cli_missing

npm install --global @openai/codex
EACCES: permission denied, mkdir '/usr/lib/node_modules/@openai'

npx --yes @openai/[email protected] --version
codex-cli 0.146.0

Candidate

Focused commit 749c6ed1e764fd2b65f525315d7dba1892a596e9 implements the manifest-pinned fallback and regression coverage on top of current providers.